What happened
Both published 2026-10-14 via the n8n September-30 advisory wave and verified via NVD REST. CVE-2026-110841 (CVSS 6.1 v4.0, CWE-639) is an IDOR-style authz bypass on the agent chat resume / tool-approval path: cross-user hijack of another member's pending agent tool approval. CVE-2026-110852 (CVSS 6.3) is a webhook path-only resolution bug letting unauthenticated callers trigger cross-project workflow execution. The n8n wave also included credential-id validation gaps on Agent node parameters (CVE-2026-110850) and an Agents-create endpoint project-ownership check gap (CVE-2026-110851).
Why it matters
These are multi-tenant isolation failures on the AI-agent surface of a widely deployed automation platform: one tenant's agent session, pending tool approvals and credentials can be reached/triggered by another project member or by an unauthenticated webhook caller, undermining the separation that multi-team n8n deployments rely on.
Attack vector
(1) CVE-2026-110841: the agent-chat resume endpoint accepts a run identifier from the request body without verifying the suspended checkpoint belongs to the caller — authenticated project members can read other members' private agent conversations and approve their pending tool calls, making the tools execute and write results into the victim's conversation. (2) CVE-2026-110852: dynamic-path webhook resolution matches on the path alone, ignoring the server-generated identifier, so an unauthenticated caller can run a workflow in an unrelated project under that project's credentials.
Affected systems
n8n < 2.41.4, 2.42.x < 2.42.1 (webhook issue also affects 1.x < 1.123.83)
Mitigation
Upgrade to n8n 2.41.4+ / 2.42.1+ (1.123.83+). For webhooks: enable node-level webhook auth (Basic/Header/JWT) on dynamic-path Webhook nodes, or restrict /webhook/* , /form/* and /mcp/* routes at the network layer. Advisories: GHSA-p3pg-xw4f-m72c and GHSA-4c7j-qff5-r9cx.